CVE-2014-9819
HighSummary
Heap-based buffer overflow in ImageMagick allows remote attackers to exploit a crafted palm file. This is a different vulnerability than CVE-2014-9823.
Risk Assessment
An attacker may exploit this vulnerability to execute arbitrary code remotely or cause unspecified impact on the system, potentially leading to data loss or system takeover.
Recommendation
It is recommended to update ImageMagick to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in ImageMagick
See all- CVE-2017-17880High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
- CVE-2017-17879High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
- CVE-2017-16546High
The ReadWPGImage function in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which may lead to denial of service or other unspecified impacts via a malformed WPG file.
- CVE-2017-15281High
The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.
- CVE-2017-15033High
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
- CVE-2017-14739High
The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.
- CVE-2017-14682High
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document.
- CVE-2017-14137High
The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.
- CVE-2017-13146High
In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
- CVE-2017-13143High
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Original NVD description (English source)
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted palm file, a different vulnerability than CVE-2014-9823.